C-SOX Auditor

JSG (Johnson Service Group, Inc.); Calgary; On-site; CAD 110,000 - 140,000; Full time

Job summary

JSG (Johnson Service Group, Inc.) in Calgary, Alberta is seeking a C-SOX Auditor to join Internal Audit. You will provide independent assurance over ICFR with emphasis on non-IT controls, reporting to Lead Auditor and Director, Internal Audit.

The role requires CPA or CIA, 8+ years in internal audit, SOX/C-SOX experience, and strong communication. You will analyze controls, document evidence, and support risk-based testing for the 2026 audit period.

Qualifications

• Must have professional CPA or CIA certification.
• Post secondary education in Business or IT.
• 8+ years of experience in internal audit or related governance, risk, and control roles with focus on non-IT controls.
• SOC, SOX or similar experience.
• Strong knowledge and application of IIA Standards; ability to conduct peer reviews.
• Strong verbal and written communications skills.
• Proven ability to resolve challenges proactively and prevent unnecessary escalation.
• Proficiency with technology to enhance audit efficiency e.g. data analysis.

Responsibilities

• Assess and document the design, implementation, and operating effectiveness of C-SOX controls for the 2026 audit period.
• Prepare workpapers that meet internal audit methodology and contain sufficient evidence.
• Develop operating-effectiveness testing plans for each control.
• Coordinate with IT auditor on IT change testing.
• Cross-reference risks, controls and evidence to the C-SOX matrix and workpapers.
• Identify and document all exceptions with details and remediation actions.
• Escalate missing evidence and scope limitations as needed.

Skills

CPA or CIA certification

8+ years internal audit experience

SOX/C-SOX experience

IIA Standards knowledge

Excellent communication skills

Data analysis proficiency

Problem solving

Risk assessment

Education

Post secondary education in Business or IT

Job description

Job Overview

The C-SOX Auditor reports to the Lead Auditor, Internal Audit, who reports to the Director, Internal Audit. The Director, Internal Audit reports functionally to the Audit Committee of the Board and administratively to the Vice-President, Finance and Compliance. This reporting structure helps ensure the independence and objectivity of the Internal Audit function.

The C-SOX Auditor provides independent, risk-based, and objective assurance over the organization's Internal Controls Over Financial Reporting (ICFR) as part of its annual C-SOX audit, with a focus on business controls and non-IT controls.

Must Haves

• Professional CPA or CIA certification is required.
• Post secondary education within Business or IT discipline.
• 8+ years of experience in internal audit or related governance, risk, and control roles with focus on non-IT controls.
• SOC, SOX, C-SOX or similar experience.
• Strong knowledge and application of IIA Standards; ability to conduct peer reviews.
• Strong verbal and written communications skills.
• Proven ability to resolve challenges proactively and prevent unnecessary escalation.
• Proven ability to resolve challenges proactively, preventing unnecessary escalation.
• Proficiency with technology to enhance audit efficiency e.g. data analysis

Nice To Haves

• CISA would be an asset.
• Electricity Industry experience
• Experience with Workday, ServiceNow

Accountabilities Include But Are Not Limited To

• Assess and document the design, implementation, and operating effectiveness of C-SOX controls for the 2026 audit period, including entity-level controls, expenditures, capital, payroll, operating reserves, revenue and settlements, credit, treasury, financial close and reporting, and relevant automated controls.
• For each control, prepare complete design assessment documentation that clearly
  • The financial reporting risk and relevant financial statement assertion.
  • The control objective and how the control addresses the identified risk.
  • The control owner and individuals responsible for performing and reviewing the control.
  • Whether the control is preventive or detective, and manual, automated or IT dependent.
  • The control frequency, timing, precision, thresholds and level of aggregation.
  • The reports, data, systems and other information used in performing the control.
  • The evidence retained to demonstrate performance and review.
  • The criteria used to conclude whether the control is appropriately designed.
  • Any control-design gaps, recommendations and management responses.
• Confirm that each control has been implemented through inquiry, observation, inspection of supporting evidence and walkthroughs. Document the transaction selected for the walkthrough from initiation through processing, recording and financial reporting.
• Develop and document an operating-effectiveness testing plan for each control, including:
  • Defined population and audit period.
  • Population completeness and accuracy procedures.
  • Sampling methodology and sample-size rationale.
  • Items selected and selection method.
  • Attributes and criteria tested.
  • Evidence inspected.
  • Test results and exceptions identified.
  • Additional or extended testing performed.
  • Final conclusion on operating effectiveness.
• Coordinate with the IT auditor on IT change testing to ensure significant changes during the test period impacting business control design are included in the IT change testing. If exceptions are noted in the completeness, accuracy and validity of information produced, coordinate recommendation(s) with the IT auditor to address control deficiencies
• Prepare workpapers that meet internal audit methodology and applicable IIA Standards and contain sufficient, reliable, relevant, and useful evidence so that an experienced auditor with no previous connection to the work can understand and reperform the procedures and reach the same conclusion.
• Cross-reference all risks, controls, procedures, samples, supporting evidence, exceptions and conclusions to the C-SOX risk and control matrix and supporting workpapers.
• Identify and document all exceptions, including the nature, cause, frequency, affected population, financial reporting risk, and potential magnitude. Assess whether exceptions represent isolated errors or control exceptions in accordance with established assessment ratings.
• Discuss potential exceptions with the control performer, the Lead Auditor and control owner, while maintaining Internal Audit's independent assessment and conclusion. Obtain and document factual confirmation, management responses, remediation actions, accountable owners and target completion dates.
• Coordinate with the Lead Auditor to ensure quality control over assigned workpapers, including evidence of preparer and reviewer sign-off, review-note clearance and timely resolution of documentation gaps.
• Maintain the C-SOX status dashboard, showing planned and completed testing, outstanding information requests, exceptions, remediation status, overdue actions and controls at risk of not being completed within the reporting timetable.
• Prepare clear summaries of control deficiencies, recurring issues, improvement opportunities, automation opportunities and matters requiring escalation to management.
• Immediately escalat[e?] missing evidence, scope limitations, suspected management override, repeated exceptions, potential fraud indicators and matters that could affect management's certification.